{"record":{"id":"cdbb356a880f2f39","repo":"nautechsystems/nautilus_trader","slug":"payload-sealing-key-is-not-configured","errorCode":null,"errorMessage":"Payload sealing key {} is not configured","messagePattern":"Payload sealing key (.+?) is not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":195,"sourceCode":"            .map_err(|_| anyhow::anyhow!(\"Failed to seal signed transaction payload\"))?;\n\n        let mut envelope = Vec::with_capacity(ENVELOPE_HEADER_LEN + ciphertext.len());\n        envelope.push(ENVELOPE_VERSION);\n        envelope.extend_from_slice(&self.active_id);\n        envelope.extend_from_slice(nonce.as_ref());\n        envelope.extend_from_slice(&ciphertext);\n        Ok(envelope)\n    }\n\n    pub(crate) fn unseal(\n        &self,\n        envelope: &[u8],\n        context: &PayloadContext,\n    ) -> anyhow::Result<Vec<u8>> {\n        validate_context(context, &self.deployment_id)?;\n        let parsed = parse_envelope(envelope)?;\n        let key = self.keys.get(&parsed.key_id).ok_or_else(|| {\n            anyhow::anyhow!(\n                \"Payload sealing key {} is not configured\",\n                hex::encode(parsed.key_id)\n            )\n        })?;\n        let aad = encode_aad(&parsed.key_id, context)?;\n        let nonce = Nonce::try_assume_unique_for_key(parsed.nonce)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload nonce is invalid\"))?;\n        let mut plaintext = parsed.ciphertext_and_tag.to_vec();\n        let plaintext_len = key\n            .open_in_place(nonce, Aad::from(aad), &mut plaintext)\n            .map_err(|_| anyhow::anyhow!(\"Signed transaction payload authentication failed\"))?\n            .len();\n        plaintext.truncate(plaintext_len);\n        anyhow::ensure!(\n            plaintext.len() <= MAX_SIGNED_TRANSACTION_BYTES,\n            \"Unsealed transaction payload is {} bytes, exceeding the {} byte limit\",\n            plaintext.len(),\n            MAX_SIGNED_TRANSACTION_BYTES","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L177-L213","documentation":"Thrown in `unseal` when the envelope's embedded key ID does not match any key in the currently configured key set, so the payload cannot be decrypted. The library keeps only configured keys and refuses to look up unknown identifiers.","triggerScenarios":"Calling `unseal` (directly or via migrate/rewrap/rollback/open execution payload functions) with an envelope sealed under a key ID absent from `self.keys` — e.g. a key was rotated out of the set or the envelope comes from another deployment.","commonSituations":"Key rotation removed the old environment's key while envelopes sealed under it still exist; restoring from a backup of a different `deployment_id`; cross-environment payload migration without carrying the old key.","solutions":["Re-add the key for the envelope's key ID to the key-set configuration and retry unsealing","Check the key ID (hex in the message) against your key-rotation history to identify which environment's key is missing","Confirm the envelope belongs to this deployment_id; if from another deployment, use that deployment's keys"],"exampleFix":"// before\nretired_envs = [] // old key removed before old payloads were unsealed\n// after\nretired_envs = [\"env-2024-q3\"] // keep retired keys until all envelopes are rewrapped","handlingStrategy":"validation","validationCode":"let parsed = parse_envelope(envelope)?;\nif !key_set.contains_key(&parsed.key_id) {\n    return Err(anyhow!(\"key {} missing; cannot unseal\", hex::encode(parsed.key_id)));\n}","typeGuard":null,"tryCatchPattern":"match sealer.unseal(&envelope, &ctx) {\n    Ok(pt) => pt,\n    Err(e) if e.to_string().contains(\"not configured\") => {\n        reload_keys_with_retained_retirements()?;\n        sealer.unseal(&envelope, &ctx)?\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Keep retired keys configured until every envelope sealed under them is unsealed or rewrapped","Track key IDs (hex) of live envelopes and ensure each stays in the key set","Never clone deployments without their full key history"],"tags":["crypto","key-management","configuration"],"backgroundTag":"decryption-key-not-found","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}